CVE-2025-9698
CVE-2025-9698
Medium · published October 13, 2025
What it is
The Plus Addons for Elementor WordPress plugin before 6.3.16 does not sanitize SVG file contents, which could allow users with minimum role access as Author to perform Stored Cross-Site Scripting attacks.
The record
Technical detail
- CVSS v3.1
- 6.8 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00308 · 22.4th percentile
- Published
- 2025-10-13T10:15Z
References (1)
EPSS history
Timeline